In her presentation entitled "Finding and Hiring the Best IT Security People," Hutchinson described her own challenges in finding the right talent. As the former CISO of Urban Outfitters, her challenge wasn't in securing the budget for security tools, but finding people to run them.

Some businesses have both tools and talent but struggle when the two don't align, she explained. You might be well-staffed with employees who lack skills to be helpful. To find the right employees, Hutchinson suggested reevaluating job requirements and approaching the hiring process similar to how you would build a security program.

The key is becoming more involved in the hiring process and being more specific when looking for candidates. Security leaders looking for talent often tell their human resources department they're seeking candidates with certain skill sets. HR then compiles a job description cobbled from descriptions they find online, which may include certifications or number of years of experience.

As a result, many companies use similar job descriptions for open positions, and applicants tailor their resumes to suit them. Many talented people who could be successful are weeded out because they lack specific credentials and experience they may not necessarily need for a specific role.

"When you go looking for people, be mindful," said Hutchinson. "The number of years isn't as good as the quality of years and most recent experience … let's not [cross off] candidates because they don't have experience in systems that don't exist anymore."

Compliance requirements also block potential candidates. Many qualifications added for compliance; for example, familiarity with HIPAA, are things a smart individual could figure out and learn. However, because HIPAA isn't on their resume, they don't make it to the interview. Similarly, certifications like the CISSP are "easy hits" and make it easy to narrow down the candidate pool but could prevent security teams from gaining valuable talent.

"We need to find people where they are and develop them into what we need them to be," she noted.

Think about what you want your employees to do, and how you want them to operate, and build your staffing strategy around it. "What's your desired outcome?" Hutchinson asked. Shaping a job description based on outcomes will result in a completely different posting.

So where do you look for job candidates? Hutchinson recommended networking with peer groups and looking to your internal tech staff to find talent. Former military members are also potential candidates; check with veterans organizations or the Wounded Warrior project to find people looking for work.

It's also worth your while to hunt for candidates in new, unexplored pools. Business school graduates could be particularly valuable at a time when security pros need to explain risks and technology issues with board members. Security teams need people who can speak to the business, write, and communicate well.

But hiring is just one piece of the equation. Retention of loyal employees is another.

"What we really need to do is start figuring out how to keep them," said Hutchinson. Most people who leave are swayed by higher salaries. Fair compensation is an obvious must-have; if you don't pay your employees fairly, you will lose them. No perk will change their mind.

That said, it takes more than money to keep talent. You need to understand what motivates your employees. Many people swap jobs because they want more challenging or exciting work. They also highly value mobility and work flexibility, which the most preferred employee benefit from 2014 to 2016, she pointed out.

"Make them excited about being at work, excited about being in security," she emphasized. "It will make them loyal to you … give them something they can get behind."

If you can't retain talent, it will ultimately cost your business. Not only will you have to invest time and resources into vetting new candidates, you'll have to show them the ropes. It costs about nine months of someone's salary to get them on-boarded, Hutchinson said.

Kelly Sheridan is the Staff Editor at Dark Reading, where she focuses on cybersecurity news and analysis. She is a business technology journalist who previously reported for InformationWeek, where she covered Microsoft, and Insurance & Technology, where she covered financial ... View Full Bio

To me this is a risk. One of the first places I hit when doing reconnaissance work is the help wanted ads and Linked profiles of targets. Looking for system information as well as software information that the business utilizes. Having too much information about your systems open to the public makes you more vulnerable. You have the opprotunity to evaluate the potential employee during the interview without putting systems at risk.

Most enterprises are using threat intel services, but many are still figuring out how to use the data they're collecting. In this Dark Reading survey we give you a look at what they're doing today - and where they hope to go.

Published: 2017-05-09NScript in mpengine in Microsoft Malware Protection Engine with Engine Version before 1.1.13704.0, as used in Windows Defender and other products, allows remote attackers to execute arbitrary code or cause a denial of service (type confusion and application crash) via crafted JavaScript code within ...

Published: 2017-05-08unixsocket.c in lxterminal through 0.3.0 insecurely uses /tmp for a socket file, allowing a local user to cause a denial of service (preventing terminal launch), or possibly have other impact (bypassing terminal access control).

Published: 2017-05-08Improper checks for unusual or exceptional conditions in Brocade NetIron 05.8.00 and later releases up to and including 06.1.00, when the Management Module is continuously scanned on port 22, may allow attackers to cause a denial of service (crash and reload) of the management module.

Published: 2017-05-08Nextcloud Server before 11.0.3 is vulnerable to an inadequate escaping leading to a XSS vulnerability in the search module. To be exploitable a user has to write or paste malicious content into the search dialogue.